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IN THE CLAIMS: 



1 . (Currently amended)A method in a data processing system for tracking 
relationships between programs and data, the method comprising: 

receiving a file access request from a program, wherein the file access request is 
for a file and is received at an operating system level; 

identifying an association between the file and the program requesting the file 
access in response to receiving the file access request; and 

storing the [[an]] association between the file and the program , wherein the 
association is used for subsequent accesses to the file such that a stored association is 
stored for each file for which file access is requested by the program . 

2. (Original)The method of claim 1, wherein the association is stored as meta data. 

3. (Original)The method of claim 1, wherein the association includes a file name for 
the file and a program name for the program. 

4. (Original)The method of claim 3, wherein the association further includes at least 
one of a location of the file, a time of file access, a date of file access, an extension for 
the file, and an identification of a user of the program. 

5. (Original)The method of claim 4, wherein the location of the file is in a remote 
data processing system. 

6. (Original)The method of claim 1, wherein the file request is one of a request to 
open the file, close the file, copy the file, or delete the file. 

7. (Original)The method of claim 1 , wherein the program is a first program and 
wherein a request to open the file originates from the first program and a request to close 
the file originates from a second program. 
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8. (Original)The method of claim 7, wherein the association includes the second 
program. 



9. (Currently amended)The method of claim 1, wherein the receiving step , the 
identifying; step, and the storing step are performed within an operating system kernel 

10. (Currently amend ed)The method of claim 1, wherein the receiving step , the 
identifying step, and the storing step are performed within a device driver. 

1 1 . (Original)The method of claim 1 0, wherein the drive driver intercepts calls 
directed to a mechanism used as a point of entry for the access. 

1 2. (Original)The method of claim 1 , wherein the storing step comprises: 
storing the association between the file and the program in a database. 

13. (Original)The method of claim 1, wherein associations are stored in a database 
and further comprising: 

receiving a request from a requestor to access the associations; 

querying the database for the associations; 

receiving a result from the database; and 

returning the result returned from the database to the requestor. 

14. (Original)The method of claim 13, wherein the associations are for a particular 
program. 

15. (Original)The method of claim 13, wherein the associations are for a particular 
file. 

16. (Original)The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in at least one of a 

registry, file, and a file system. 
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17. (Currently amended)A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instructions to receive a file access request from a program, wherein 
the file access request is for a file and is received at an operating system level; identify an 
association between the file and the program requesting the file access in response to 
receiving the file access request; and store the [[an]] association between the file and the 
program , wherein the association is used for subsequent accesses to the file such that a 
stored association is stored for each file for which file access is requested by the program . 

18. (Original)The data processing system of claim 17, wherein the bus system is a 
single bus. 

19. (Original)The data processing system of claim 17, wherein the bus system 
includes a primary bus and a secondary bus. 

20. (Original)The data processing system of claim 17, wherein the processing unit 
includes a plurality of processors. 

21 . (Original)The data processing system of claim 1 7, wherein the communications 
unit is one of a modem and Ethernet adapter. 

22. (Currently amended)A data processing system for tracking relationships between 
programs and data, the data processing system comprising: 

receiving means for receiving a file access request from a program, wherein the 
file access request is for a file and is received at an operating system level; 
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identifying means for identifying an association between the file and the program 
requesting the file access in response to receiving the file access request; and 

storing means for storing the [[an]] association between the file and the program^ 
wherein the association is used for subsequent accesses to the file such that a stored 
association is stored for each file for which file access is requested by the program . 

23. (Original)The data processing system of claim 22, wherein the association is 
stored as meta data. 

24. (Original)The data processing system of claim 22, wherein the association 
includes a file name for the file and a program name for the program. 

25. (Original)The data processing system of claim 24, wherein the association further 
includes at least one of a location of the file, a time of file access, a date of file access, an 
extension for the file, and an identification of a user of the program. 

26. (Original)The data processing system of claim 25, wherein the location of the file 
is in a remote data processing system. 

27. (Original)The data processing system of claim 22, wherein the file request is one 
of a request to open the file, close the file, copy the file, or delete the file. 

28. (Original)The data processing system of claim 22, wherein the program is a first 
program and wherein a request to open the file originates from the first program and a 
request to close the file originates from a second program. 

29. (Original)The data processing system of claim 22, wherein the association 
includes the second program. 
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30. (Currently amended)The data processing system of claim 22, wherein the 
receiving means , the identifying means, and the storing means are located perform e d 
within an operating system kernel. 

3 1 . (Currently amended)The data processing system of claim 22, wherein the 
receiving means , the identifying means, and the storing means are located p e rform e d 
within a device driver. 

32. (Original)The data processing system of claim 31, wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

33. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in a database. 

34. (Original)The data processing system of claim 22, wherein associations are stored 
in a database, wherein the receiving means is a first receiving means, and further 
comprising: 

second receiving means for receiving a request from a requestor to access the 
associations; 

querying means for querying the database for the associations; 
third receiving means for receiving a result from the database; and 
returning means for returning the result returned from the database to the 
requestor. 

35. (Original)The data processing system of claim 34, wherein the associations are for 
a particular program. 

36. (Original)The data processing system of claim 34, wherein the associations are for 
a particular file. 
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37. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in at least one 
of a registry, file, and a file system. 

38. (Currently amended) A computer program product in a computer readable medium 
for tracking relationships between programs and data, the computer program product 
comprising: 

first instructions for receiving a file access request from a program, wherein the 
file access request is for a file and is received at an operating system level; 

second instructions for identifying an association between the file and the 
program requesting the file access in response to receiving the file access request; and 

third s e cond instructions for storing the [[an]] association between the file and the 
program , wherein the association is used for subsequent accesses to the file such that a 
stored association is stored for each file for which file access is requested by the program . 

39. (Original)The computer program product of claim 38, wherein the association is 
stored as meta data. 

40. (Original)The computer program product of claim 38, wherein the association 
includes a file name for the file and a program name for the program. 

41 . (Original)The computer program product of claim 40, wherein the association 
further includes at least one of a location of the file, a time of file access, a date of file 
access, an extension for the file, and an identification of a user of the program. 

42. (Original)The computer program product of claim 41, wherein the location of the 
file is in a remote data processing system. 

43. (Original)The computer program product of claim 38, wherein the file request is 
one of a request to open the file, close the file, copy the file, or delete the file. 
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44. (Original)The computer program product of claim 38, wherein the program is a 
first program and wherein a request to open the file originates from the first program and 
a request to close the file originates from a second program. 

45. (Original)The computer program product of claim 38, wherein the association 
includes the second program. 

46. (Currently amended)The computer program product of claim 38, wherein the first 
instructions , the second instructions, and the third second instructions are located 
p e rform e d within an operating system kernel. 

47. (Currently amended)The computer program product of claim 38, wherein the first 
instructions , the second instructions, and the third seco n d instructions are located 
performed within a device driver. 

48. (Original)The computer program product of claim 47, wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

49. (Currently amended)The computer program product of claim 38, wherein the 
third s e cond instructions comprises: 

sub-instructions for storing the association between the file and the program in a 
database. 

50. (Currently amended)The computer program product of claim 38, wherein 
associations are stored in a database and further comprising: 

fourth third instructions for receiving a request from a requestor to access the 
associations; 

fifth fo ur th instructions for querying the database for the associations; 
sixth fifth instructions for receiving a result from the database; and 
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seventh sixth instructions for returning the result returned from the database to the 
requestor. 

5 1 . (Original)The computer program product of claim 50, wherein the associations 
are for a particular program. 

52. (Original)The computer program product of claim 50, wherein the associations 
are for a particular file. 

53. (Currently amended)The computer program product of claim 38, wherein the 
third s econd instructions comprises: 

sub-instructions for storing the association between the file and the program in at 
least one of a registry, file, and a file system. 
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